Threat Investigation
Request a demo

CVE-2018-8877

Medium

Description

Information disclosure in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices allows remote attackers to acquire information on internal network IP address ranges by reading the new_lan_ip variable on the error_page.htm page.

SeverityMedium
CVSS5.3
Exploit probability—
ProductAsus Firmware
PublishedFeb 27, 2020
First seenFeb 27, 2020

How to fix

Update
  • asus asus_firmware3.0.0.4.382.50470 or later
  • asuswrt-merlin asuswrt-merlin384.4 or later

Affected products

ProductAffected versionsFixed in
asus asus_firmwarev < 3.0.0.4.382.504703.0.0.4.382.50470
asuswrt-merlin asuswrt-merlinv < 384.4384.4

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.